From 8b29c5e83a82e8d447c46db4e0aeaa84043f52e9 Mon Sep 17 00:00:00 2001 From: Matthias Braun Date: Thu, 6 Aug 2026 14:43:38 +0200 Subject: [PATCH] Hint on checking input data only for entities with keys --- guides/security/authorization.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/guides/security/authorization.md b/guides/security/authorization.md index 7d779d86f..f0c521583 100644 --- a/guides/security/authorization.md +++ b/guides/security/authorization.md @@ -629,8 +629,11 @@ annotate Orders with @(restrict: [ A user with accounting areas `[Development, Research]` is not able to send an `UPDATE` request, that changes `accountingArea` from `Research` or `Development` to `CarFleet`, for example. Note that the `UPDATE` on instances _not matching the request user's accounting areas_ (for example, `CarFleet`) are rejected by standard instance-based authorization checks. -Starting with CAP Java `4.0`, deep authorization is active by default. -It can be disabled by setting cds.security.authorization.instanceBased.checkInputData: false. +::: hint +Input data is not checked for entities which misses key elements; such entities must be protected at the application model level. +::: + +The feature can be disabled by setting cds.security.authorization.instanceBased.checkInputData: false. ### Rejected Entity Selection { #reject-403 .java}